Reliable, affordable business hosting from Yahoo! Web Hosting
Home Sitemap

SEO ARTWORKS - SERVICES

What to Expect after you hire us? A scope of work - anticipated results, analytics, follow-ups and more...

TWITTER: THE DARK SIDE
IPA BOTS vs. HUMANS Analysis for Ex3!

Step by step, grueling analysis of IPAs coming to Bit.ly's short URLs and clicking on it!

Clicks or Click Fraud?

Bit.ly Clicks Animation

Check out animation about millions of bots clicks show at Bit.ly as "statistics"

Twitter: The Dark Side Study

Check out these Ads and Click ones of Your Interest

 

 

 

Twitter: The Dark Side | IPA BOTS vs. HUMANS Analysis for Ex3

 

First row : Bot/Human # Clicks per IP IP ADDRESS REVERSE DNS

Second row : analysis process and the call explained

B 8, 128.121.156.53 , fbx2.83degrees.com

At first blush it seems like a nice human from Englewood, Colorado that most likely works for / with Greenpeace. BUT it behaving on-line and browsing patterns looks more like crawling patterns; a call – it’s a bot; it also generates some duplicate clicks when coming from Powertwitter so it raises a flag; perhaps Powertwitter has a bug? More info welcomed. 100% accurate call not possible and we propose to count it as a bot.

B 6, 67.218.99.195 , Error: No RDNS

given this IPA strange appearances all over the Internet, it is most likely a crawler ran from linode cloud.

B 6, 216.129.119.81 , ramp2b.cuil.com

This IPA comes with Mozilla/5.0 and it is identified as search engine Ciuli’s Twiceler-0.9 www dot cuil.com/twiceler/robot.html bot

B 3, 216.24.142.45 , flx1-ppp45.lvdi.net

This IP is associated with http://me.dium.com redirect to http://www.oneriot.com/ “real time search for real time web” therefore a Call – it’s a bot.

B 3, 128.241.112.231 , Error: No RDNS

Seems like a nice human from Englewood, Colorado BUT it behaving on-line and browsing patterns looks more like crawling patterns; a call – it’s a bot.

B 2, 64.233.172.18 , Error: No RDNS

This is AppEngine-Google; (+http://code.google.com/appengine) and also Google-Sitemaps/1.0 slurper. Obviously a BOT.

B 2, 216.24.142.47 , flx1-ppp47.lvdi.net

http://me.dium.com redirect to http://www.oneriot.com/ “real time search for real time web” therefore a Call – it’s a bot.

B 2, 216.24.142.46 , flx1-ppp46.lvdi.net

http://me.dium.com redirect to http://www.oneriot.com/ “real time search for real time web” therefore a Call – it’s a bot.

? 2, 173.126.31.41 , 173-126-31-41.pools.spcsdns.net

Impossible to call. If you know more, please let us know.

? 2, 93.133.78.200 , mnch-5d854ec8.pool.mediaWays.net

Impossible to call if you know more about this IPA please let us know.

B 2, 66.249.71.174 , crawl-66-249-71-174.googlebot.com

GOOGLEBOT

H 2, 166.122.160.117 , ewc60117.ewc.hawaii.edu

Most likely humans from Hawaii.

H 1, 24.147.28.154 , c-24-147-28-154.hsd1.ma.comcast.net

Most likely a human from Andover, MS.

H 1, 195.159.40.204 , dhcp204.ns5.start.no

Most likely a human from Norway.

B 1, 192.122.237.11 , nkugateway.nku.edu

This IPA has been extensively used to send very spam-like email messages, bulks of them, ergo we classify it as a bot.

!! 5, 189.220.23.128 , Error: No RDNS

This is us – do not count as a human.


H 1, 187.50.70.66 , Error: No RDNS

Most likely a human from Brazil.

B 1, 150.70.84.43 , Error: No RDNS

It could be a human but was seen at least one “honey pot” ergo the Call is – it’s a bot.

H 1, 76.171.100.22 , cpe-76-171-100-22.socal.res.rr.com

This is Jeanette from a non smoggy Lake Elsinore, California. This is an interesting find; a Grumpy Old Trucker’s blog records IPA of people that comment on his articles.

H 1, 72.90.110.171 , pool-72-90-110-171.ptldor.fios.verizon.net

Most likely a human from Portland, Oregon.

H 1, 71.59.234.85 , c-71-59-234-85.hsd1.or.comcast.net

Most likely a human from Dufur, Oregon.

H 1, 68.197.252.117 , ool-44c5fc75.dyn.optonline.net

Most likely a human from Westwood, New Jersey.

H 1, 68.148.18.128 , S010600045a2b0d0e.ed.shawcable.net

Most likely a human from Canada.

B 1, 24.7.238.126 , c-24-7-238-126.hsd1.in.comcast.net

Even though it might be a human from South Bend, Indiana, that IPA was seen performing as a mail server while using different names so we’d call it a Spambot.

H 1, 24.103.71.242 , rrcs-24-103-71-242.nyc.biz.rr.com

Most likely a human from Brooklyn, New York.

B 1, 170.213.131.190 , Error: No RDNS

This IPA is being used in a manner of dictionary attacker, maybe through Facebook.

Examples of e-mail from that IPA as seen at our friends Honey Pot:

from: "Facebook Inform Center" <provisor23@facebook.com>

Subject: Facebook news: Burning Dancing Girl. Perfect boobs

From: <janet_huskinson@users.moneyhelpline.co.uk>

Subject: It will tear you pants!

From: <heglauser03@fragolina.it>

Subject: Might up your schlong!

H 1, 166.70.192.169 , thotman.dsl.xmission.com

Most likely a human from Salt Lake City, Utah.

H 1, 113.67.107.245 , Error: No RDNS

Most likely a human from China.

H 1, 83.167.112.14 , n112h14.catv.ext.ru

This IPA came from Moscow, Russia, and even though it was seen on at least one honey pot, it may be someone using Hulu or Netflix through a proxy so we give our suspicious friend from Moscow a benefit of doubt and call it a human.

B 1, 75.101.203.230 , ec2-75-101-203-230.compute-1.amazonaws.com

Click came from the Amazon’s Elastic Compute Cloud, EC2 design customers to run their own applications. It is unlikely, given all other metrics, this is not some home-made bot. Call – it’s a bot.

H 1, 74.243.34.15 , adsl-243-34-15.bix.bellsouth.net

Most likely a human from Gulfport, Mississippi.

H 1, 72.37.171.132 , 139ob.scansafe.net

It’s a human. But we know too much about him so let us stick with a call alone.

B 1, 72.3.221.188 , Error: No RDNS

This thing identifies itself as the ThingFetcher and uses honey pots, therefore a call; it’s a bot!

H 1, 67.164.176.184 , c-67-164-176-184.hsd1.co.comcast.net

Most likely a human from Denver, Colorado.

B 1, 66.249.71.174 , crawl-66-249-71-174.googlebot.com

GOOGLEBOT

H 1, 64.105.86.66 , h-64-105-86-66-static.sttnwaho.covad.net

Most likely a human from Portland, Oregon.

B 1, 38.99.68.204 , Error: No RDNS

This is FriendFeed bot

Mozilla/5.0 (compatible; FriendFeedBot/0.1; +Http://friendfeed.com/about/bot)

B 1, 209.20.71.54 , 209-20-71-54.slicehost.net

This is a Ginkx, Twitter related bot.

H 1, 174.143.246.198 , 174-143-246-198.static.cloud-ips.com

Most likely a human from San Antonio, Texas.

H 1, 174.132.144.150 , web16.tumblr.com

Hmm… came from tumblr so it could be a human. Let’s give them a credit and call a human for this one.

B 1, 174.129.178.187 , ec2-174-129-178-187.compute-1.amazonaws.com

These might be are our friends and neighbors on the Amazon’s cloud, Bit.ly, and their own bot, a bitlybot or someone else’s bot that slurps tweets from bitly and calls it a bitlybot.

? 1, 128.121.156.55 , fbx4.83degrees.com

We don’t trust this human / bot from Englewood, Colorado so it is impossible to call.

B 1, 87.21.56.139 , host139-56-dynamic.21-87-r.retail.telecomitalia.it

This IPA is being used in a manner of dictionary attacker, maybe through Facebook.

Examples of e-mail from that IPA as seen at our friends Honey Pot:

From: "Terra Mcintyre" <oliver@webmarketingezine.com>

Subject: MS Office 2007, AutoCAD 2008, Adobe Acrobat 8

From: "Devin Telling" <Devin-singlefi@kowell.com>

Subject: simagree

From: "Rachelle Cervantes" <giuseppe.ganci@sanpaoloimi.c

Subject: Software Bereich Ausbau - Preis Untergang

H 1, 76.176.131.0 , cpe-76-176-131-0.san.res.rr.com

Likely a human from Carlsbad, California.

H 1, 75.167.10.81 , 75-167-10-81.phnx.qwest.net

Likely a human from Phoenix, Arizona.

H 1, 68.19.134.127 , adsl-19-134-127.jan.bellsouth.net

Most likely a human from Laurel, Mississippi

H 1, 67.183.214.180 , c-67-183-214-180.hsd1.wa.comcast.net

Most likely a human from Bothell, Washington.

H 1, 24.17.166.7 , c-24-17-166-7.hsd1.wa.comcast.net

Most likely a human from Blaine, Washington.

H 1, 206.53.157.118 , Error: No RDNS

Most likely an U.S. based human using Blackbarry for browsing.

H 1, 200.55.99.84 , 200-55-99-84.dsl.prima.net.ar

Most likely a human from Argentina.

B 1, 122.166.14.44 , ABTS-KK-Static-044.14.166.122.airtelbroadband.in

This IPA came from India and is being used in a manner of mail server or dictionary attacker. Examples of e-mail from that IPA as seen at our friends Honey Pot:

From: "Meri Ycoo" <sanjuanita_bocchino@post.wildkamperen

Subject: Tips and Tricks

From: "Harrison Alvarado" <bangsllo8@schoeler.de>

Subject: You have received an eCard

From: <elfreda.youngman@moo43.school-survival.net>

Subject: Be an asset for ladies

From: <alvasornsen@switchboard.agendamusic.co.uk>

Subject: Might up your schlong!

From: <kerryhguimaraes@mx1.hypeindustries.com>

Subject: Male insatiability packed

Therefore it is a spam bot.

H 1, 99.34.5.39 , 99-34-5-39.lightspeed.cntmoh.sbcglobal.net

Most likely a human from Argentina.

H 1, 85.214.39.2 , bleeper.de

Most likely a human from Germany.

H 1, 85.127.171.44 , 85-127-171-44.dynamic.xdsl-line.inode.at

Most likely a human from Austria.

B 1, 84.63.36.78 , dslb-084-063-036-078.pools.arcor-ip.net

This IPA came from Germany and is being used in a manner of mail server or dictionary attacker. Examples of e-mail from that IPA as seen at our friends Honey Pot:

From: "Marijke" <wyman@mypersonalemail.com>

Subject: Ik schrijf julie om te vertellen dat ik eindelijk

From: "Oqlu" <negadstr_1987@EDENPR.org>

Subject: For asayne04@klevo.premedic.com.ru

So this is a Spambot

H 1, 84.191.230.73 , p54BFE649.dip.t-dialin.net

Maybe a human from Austria

H 1, 84.191.184.161 , p54BFB8A1.dip.t-dialin.net

Maybe a human from Austria

H 1, 84.141.115.137 , p548D7389.dip.t-dialin.net

Maybe a human from Austria

H 1, 83.149.199.55 , narva.ispras.ru

Maybe a human from Austria

H 1, 83.149.199.54 , dvina.ispras.ru

Maybe a human from Austria

H 1, 83.149.199.49 , niagara.ispras.ru

Maybe a human from Austria

H 1, 80.190.153.18 , Error: No RDNS

Most likely a human from Germany.

B 1, 80.187.109.155 , tmo-109-155.customers.d1-online.com

This IPA came from Germany and is being used in a manner of mail server or dictionary attacker. Examples of e-mail from that IPA as seen at our friends Honey Pot:

From: © VIAGRA ® Official Site <junko.ashly@myxlplyx.low

Subject: Dear junko.ashly@myxlplyx.lowsfishingadventures.co

From: "Finer Sigrid" <wxsinha007@m.dk.pp.ru>

Subject: Your serial number

Therefor it’s a Spambot.

H 1, 78.42.201.151 , HSI-KBW-078-042-201-151.hsi3.kabel-

badenwuerttemberg.de

Most likely a human from Germany.

H 1, 75.32.240.15 , 75-32-240-15.lightspeed.enctca.sbcglobal.net

Most likely a human from Germany.

H 1, 74.57.122.251 , modemcable251.122-57-74.mc.videotron.ca

Most likely a human from Quebec, Canada.

B 1, 72.3.221.188 , Error: No RDNS

This thing identifies itself as the ThingFetcher and uses honey pots, therefore a call; it’s a bot!

H 1, 68.189.245.235 , 68-189-245-235.dhcp.oxfr.ma.charter.com

Most likely a human from Pepperell, Massachusetts

H 1, 24.30.153.217 , cpe-24-30-153-217.san.res.rr.com

Most likely a human from San Diego, California.

H 1, 212.36.161.107 , Error: No RDNS

Most likely a human from Great Britain.

? 1, 174.129.115.46 , ec2-174-129-115-46.compute-1.amazonaws.com

Could be a human despite Amazon’s Cloud. Difficult to call.

H 1, 157.161.38.229 , cable-static-38-229.teleport.ch

Most likely a human from Switzerland

H 1, 141.43.144.163 , 144-163.ikmz-user.tu-cottbus.de

Most likely a human from Germany.

 

PART XIV: Bit.ly' s BOTS vs. HUMANS ratio by Google's AdSense

 

 



Licensees may copy, distribute, display and perform the work and make derivative works based on it only if they give the authors the credits and only for noncommercial purposes.
For on-line displays of the work and derivative works licensees must include SEO Artworks link as follows: http://www.seo-artworks.com/Twitter/twitter-study.htm.


SHARE YOUR THOUGHTS

 

 

 

Valid CSS! Valid XHTML 1.0 Transitional